# SZB-1ac4bc8960: Barracuda warns customers to patch two flaws enabling root command execution

BleepingComputer reports that Barracuda Networks warned customers to patch two vulnerabilities. The item says the flaws can let attackers run commands with root privileges.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Barracuda
- Product: Web Security Gateway, WAF Control Center, Web Application Firewall
- Status: Confirmed
- Sources: 5 distinct
- First seen: 2026-11-02 14:02 UTC
- Confirmed: 2026-11-03 17:16 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Apply Barracuda's patches to affected devices now.
- Check Barracuda's advisory to confirm which products and versions are affected.
- Review device logs for unexpected commands or root-level changes.
- Restrict administrative access to affected devices until they are patched.
- Apply Barracuda's vendor-issued patches to affected devices immediately
- Restrict management interface access to trusted networks

## Timeline

- 2026-11-02 14:01 UTC: Made public by Mastodon
- 2026-11-02 14:02 UTC: First seen by cve.now
- 2026-11-03 17:16 UTC: Record last updated
- 2026-11-03 17:16 UTC: Confirmed as CVE-2026-116606

## Evidence (5 sources)

- 2026-11-02 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117547209234889942): “An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible bac...”
- 2026-11-02 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117547209286422728): “Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products usin...”
- 2026-11-02 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117547402181833180): “Patch two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that allow attackers to gain Barracuda root access across multiple appliances.”
- 2026-11-03 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/): “Cybersecurity company Barracuda Networks warned customers to patch two vulnerabilities that can let attackers run commands with root privileges.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzg4hwjpzt2o))
- 2026-11-03 · Press · [The Hacker News](https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html): “Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-1ac4bc8960&body=https%3A%2F%2Fcve.now%2FSZB-1ac4bc8960%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-1ac4bc8960

### Has Barracuda confirmed it?

Yes. Confirmed as CVE-2026-116606.

Source: https://mastodon.social/@EUVD_Bot/117547209234889942, https://mastodon.social/@EUVD_Bot/117547209286422728, https://infosec.exchange/@DailyCyberSecurity/117547402181833180, https://www.bleepingcomputer.com/news/security/barracuda-warns-of-critical-flaws-allowing-root-access-to-devices/, https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html

### What should Barracuda users do?

Apply Barracuda's patches to affected devices now. Check Barracuda's advisory to confirm which products and versions are affected. Review device logs for unexpected commands or root-level changes. Restrict administrative access to affected devices until they are patched. Apply Barracuda's vendor-issued patches to affected devices immediately. Restrict management interface access to trusted networks.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-116606.

Source: https://cve.now/CVE-2026-116606

## Tracked as

- [CVE-2026-116606](https://cve.now/CVE-2026-116606.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-1ac4bc8960
Site guide for agents: https://cve.now/llms.txt